From c7866c1dc566fcf48911492abfe33c673ee29961 Mon Sep 17 00:00:00 2001
From: yushijinhun <yushijinhun@gmail.com>
Date: Sun, 18 Feb 2018 09:24:03 +0800
Subject: [PATCH] use base64 to encode prefetched data

this prevents commandline injection
---
 .../to2mbn/authlibinjector/AuthlibInjector.java  | 16 ++++++++++++++--
 .../org/to2mbn/authlibinjector/util/IOUtils.java |  5 +++++
 .../to2mbn/authlibinjector/util/KeyUtils.java    |  3 ++-
 3 files changed, 21 insertions(+), 3 deletions(-)

diff --git a/src/main/java/org/to2mbn/authlibinjector/AuthlibInjector.java b/src/main/java/org/to2mbn/authlibinjector/AuthlibInjector.java
index 02b9ba7..f74c4ef 100644
--- a/src/main/java/org/to2mbn/authlibinjector/AuthlibInjector.java
+++ b/src/main/java/org/to2mbn/authlibinjector/AuthlibInjector.java
@@ -1,11 +1,14 @@
 package org.to2mbn.authlibinjector;
 
+import static java.nio.charset.StandardCharsets.UTF_8;
 import static java.util.Optional.empty;
 import static java.util.Optional.of;
 import static org.to2mbn.authlibinjector.util.IOUtils.readURL;
+import static org.to2mbn.authlibinjector.util.IOUtils.removeNewLines;
 import java.io.IOException;
 import java.lang.instrument.ClassFileTransformer;
 import java.text.MessageFormat;
+import java.util.Base64;
 import java.util.Optional;
 import java.util.function.Consumer;
 import org.to2mbn.authlibinjector.transform.ClassTransformer;
@@ -56,9 +59,10 @@ public final class AuthlibInjector {
 		if (apiRoot == null) return empty();
 		info("api root: {0}", apiRoot);
 
-		String metadataResponse = System.getProperty("org.to2mbn.authlibinjector.config.prefetched");
+		String metadataResponse;
 
-		if (metadataResponse == null) {
+		String prefetched = System.getProperty("org.to2mbn.authlibinjector.config.prefetched");
+		if (prefetched == null) {
 			info("fetching metadata");
 			try {
 				metadataResponse = readURL(apiRoot);
@@ -69,6 +73,14 @@ public final class AuthlibInjector {
 
 		} else {
 			info("prefetched metadata detected");
+			try {
+				metadataResponse = new String(Base64.getDecoder().decode(removeNewLines(prefetched)), UTF_8);
+			} catch (IllegalArgumentException e) {
+				info("unable to decode metadata: {0}\n"
+						+ "metadata to decode:\n"
+						+ "{1}", e, prefetched);
+				return empty();
+			}
 		}
 
 		debug("metadata: {0}", metadataResponse);
diff --git a/src/main/java/org/to2mbn/authlibinjector/util/IOUtils.java b/src/main/java/org/to2mbn/authlibinjector/util/IOUtils.java
index c21178b..4fd275f 100644
--- a/src/main/java/org/to2mbn/authlibinjector/util/IOUtils.java
+++ b/src/main/java/org/to2mbn/authlibinjector/util/IOUtils.java
@@ -27,6 +27,11 @@ public final class IOUtils {
 		return new String(w.toCharArray());
 	}
 
+	public static String removeNewLines(String input) {
+		return input.replace("\n", "")
+				.replace("\r", "");
+	}
+
 	private IOUtils() {}
 
 }
diff --git a/src/main/java/org/to2mbn/authlibinjector/util/KeyUtils.java b/src/main/java/org/to2mbn/authlibinjector/util/KeyUtils.java
index d23f586..168c64d 100644
--- a/src/main/java/org/to2mbn/authlibinjector/util/KeyUtils.java
+++ b/src/main/java/org/to2mbn/authlibinjector/util/KeyUtils.java
@@ -1,5 +1,6 @@
 package org.to2mbn.authlibinjector.util;
 
+import static org.to2mbn.authlibinjector.util.IOUtils.removeNewLines;
 import java.security.GeneralSecurityException;
 import java.security.KeyFactory;
 import java.security.PublicKey;
@@ -9,7 +10,7 @@ import java.util.Base64;
 public final class KeyUtils {
 
 	public static byte[] decodePublicKey(String pem) throws IllegalArgumentException {
-		pem = pem.replace("\n", "");
+		pem = removeNewLines(pem);
 		final String header = "-----BEGIN PUBLIC KEY-----";
 		final String end = "-----END PUBLIC KEY-----";
 		if (pem.startsWith(header) && pem.endsWith(end)) {